From c25089f12ec6d627baceddd3d778ca646d8251f1 Mon Sep 17 00:00:00 2001 From: Hetvi Thakar Date: Thu, 5 Nov 2026 01:00:07 -0800 Subject: [PATCH] python3-virtualenv: Ignore CVE-2026-113724 Analysis: - The advisory [1] describes a deletion-error callback changing the permissions of a symlink target. - In 21.2.1, safe_delete() always passes ignore_errors=True to shutil.rmtree(), which disables the supplied error callback. This remains true after the existing security backports. - Upstream enabled that callback later in [2]. The chmod recovery path fixed by [3] is therefore unreachable in this recipe. Reference: [1] https://github.com/pypa/virtualenv/security/advisories/GHSA-43mp-35q3-x3fq [2] https://github.com/pypa/virtualenv/pull/3222 [3] https://github.com/pypa/virtualenv/commit/2bfdc0230d1b2685fedfcfe66c835b9a2ec7c440 Signed-off-by: Hetvi Thakar Signed-off-by: Anuj Mittal --- meta-python/recipes-devtools/python/python3-virtualenv_21.2.1.bb | 1 + 1 file changed, 1 insertion(+) diff --git a/meta-python/recipes-devtools/python/python3-virtualenv_21.2.1.bb b/meta-python/recipes-devtools/python/python3-virtualenv_21.2.1.bb index b554c3a4f8..d5f598e576 100644 --- a/meta-python/recipes-devtools/python/python3-virtualenv_21.2.1.bb +++ b/meta-python/recipes-devtools/python/python3-virtualenv_21.2.1.bb @@ -56,3 +56,4 @@ CVE_PRODUCT = "virtualenv" # The batch activator only supports Windows interpreters. CVE_STATUS[CVE-2026-102937] = "${@'not-applicable-platform: Windows cmd.exe batch activation is not selected for Linux interpreters' if (d.getVar('TARGET_OS') or '').startswith('linux') else ''}" CVE_STATUS[CVE-2026-113718] = "not-applicable-config: Xonsh activation was introduced in virtualenv 21.3.0 and is absent from 21.2.1" +CVE_STATUS[CVE-2026-113724] = "not-applicable-config: safe_delete() uses ignore_errors=True, so its chmod error callback is unreachable"